Path Expression. Enter the string that matches the S3 objects you'd like to collect. You can use a wildcard (*) in this string. (DO NOT use a leading forward slash. See Amazon Path Expressions.) The S3 bucket name is not part of the path. Don’t include the bucket name when you are setting the Path Expression.

Source Category. Enter a source category. For example, AWS/WAF.

Access Method. Select the appropriate AWS access control mechanism.

Scan Interval. Use the default of Automatic, or select a scan interval from the pulldown.

Enable Timestamp Parsing. Select the checkbox.

Time Zone. Click Ignore time zonefrom log file and instead use, and select "UTC" from the list of time zones.